README.md

Privacy protection center for you and your devices

AdGuard Home

AdGuard Home is a network-wide software for blocking ads & tracking. After you set it up, it'll cover ALL your home devices, and you don't need any client-side software for that.

How does AdGuard Home work?

AdGuard Home operates as a DNS server that re-routes tracking domains to a "black hole," thus preventing your devices from connecting to those servers. It's based on software we use for our public AdGuard DNS servers -- both share a lot of common code.

How is this different from public AdGuard DNS servers?

Running your own AdGuard Home server allows you to do much more than using a public DNS server.

Choose what exactly will the server block or not block;

Monitor your network activity;

Add your own custom filtering rules;

In the future, AdGuard Home is supposed to become more than just a DNS server.

If the file does not exist, create it in the same folder, type these two lines down and save.

Additional configuration

Upon the first execution, a file named AdGuardHome.yaml will be created, with default values written in it. You can modify the file while your AdGuard Home service is not running. Otherwise, any changes to the file will be lost because the running program will overwrite them.

Settings are stored in YAML format, possible parameters that you can configure are listed below:

bind_host — Web interface IP address to listen on.

bind_port — Web interface IP port to listen on.

auth_name — Web interface optional authorization username.

auth_pass — Web interface optional authorization password.

dns — DNS configuration section.

port — DNS server port to listen on.

protection_enabled — Whether any kind of filtering and protection should be done, when off it works as a plain dns forwarder.

filtering_enabled — Filtering of DNS requests based on filter lists.

blocked_response_ttl — For how many seconds the clients should cache a filtered response. Low values are useful on LAN if you change filters very often, high values are useful to increase performance and save traffic.

ratelimit — DDoS protection, specifies in how many packets per second a client should receive. Anything above that is silently dropped. To disable set 0, default is 20. Safe to disable if DNS server is not available from internet.

ratelimit_whitelist — If you want exclude some IP addresses from ratelimiting but keep ratelimiting on for others, put them here.

refuse_any — Another DDoS protection mechanism. Requests of type ANY are rarely needed, so refusing to serve them mitigates against attackers trying to use your DNS as a reflection. Safe to disable if DNS server is not available from internet.

bootstrap_dns — DNS server used for initial hostname resolution in case if upstream server name is a hostname.

parental_sensitivity — Age group for parental control-based filtering, must be either 3, 10, 13 or 17 if enabled.

Acknowledgments

You might have seen that CoreDNS was mentioned here before — we've stopped using it in AdGuardHome. While we still use it on our servers for AdGuard DNS service, it seemed like an overkill for Home as it impeded with Home features that we plan to implement.

For a full list of all node.js packages in use, please take a look at client/package.json file.